Packet-based data networks continue to grow in importance, and it is often desirable to monitor network traffic associated with these packet-based networks. For certain network packet communication systems, packet flow statistics are collected and reported for network packet flows. IPFIX (IP Flow Information eXport) is a protocol standard associated with such collection and reporting of statistics for network packet flows. IPFIX is based upon a prior protocol called NetFlow that was developed by Cisco Systems.
FIG. 1A (Prior Art) is a block diagram of an example embodiment 100 for a network communication system where packet flow statistics are collected and reported using the IPFIX protocol standard. A network 102 includes a number of different network connected devices that are communicating with each other using a number of different packet flows. At least a portion of these packet flows are routed by the network router 110, which can include a number of different input/output (I/O) ports that are used to receive and send packets. For the embodiment 100, packets received by the network router 110 are represented by input packets 104, and packets sent by the network router 110 are represented by output packets 106. A switch 112 within the network router 110 receives the input packets 104 from network sources and routes them to the appropriate network destinations through output packets 106. These input and output packets 104/106 are assumed to include packets within a number of different packet flows for the network 102.
The IPFIX engine 120 also receives the input packets 104 and processes the packets to collect flow statistics associated with packet flows represented within the input packets 104. These packet flow statistics are stored in a flow table 122. When the termination of a particular packet flow is detected by the IPFIX engine 120, the IPFIX engine 120 sends a packet reporting the data record for the packet flow that was stored in the flow table 122. These IPFIX report packets 108 are sent to an IPFIX collection server 130 where the flow data statistics provided by the IPFIX report packets 108 are aggregated and stored in a flow statistics database 132. The IPFIX collection server 130 can also include an IPFIX controller that controls operation of the IPFIX collection server 130. A user interface 134 can also be included within the collection server 130 and allows external uses, such as network managers, to access, view and analyze the data within the flow statistics database 132.
FIG. 1B (Prior Art) is a diagram of an example embodiment for the flow table 122 that is used by the IPFIX engine 120 to collect and store flow data associated with the packet flows 128 within the input packets 104 as represented by FLOW1, FLOW2, . . . , FLOW(N). For each of the packet flows 128, a five-tuple flow identifier 124 is stored that includes a source address (SIP), a destination address (DIP), a protocol type (TYPE), a source port (S-PORT), and a destination port (D-PORT). For each of the packet flows 128, flow data is also collected and stored. This collected data 126 includes a start time (START), an end time (END), number of bytes (# BYTES), and a number of packets (# PACKETS). It is noted that the source and destination addresses (SIP/DIP) can be, for example, source and destination IP (Internet Protocol) addresses. The protocol type represents the communication protocol used for the packet flow such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol), SCTP (Stream Control Transmission Protocol), and/or other communication protocols. The source and destination ports (S-PORT/D-PORT) can be, for example, communication ports used at the packet source and destination for the packet flow. When the IPFIX engine 120 determines that a packet flow has ended, the flow record for that packet flow is sent in a report packet to the collection server as indicated by arrow 125.
Disadvantages to implementing IPFIX processing within the network router 110, however, include the memory space required for the flow table 122 and the additional processing resources required for the IPFIX engine 120. The main performance bottleneck is the memory bandwidth and size required for the flow table 122.